Privacy policy

Payfast Payments by GROWTH HACK. Last updated: 6 November 2026

1. Who we are

GROWTH HACK ("we", "us") operates Payfast Payments (the "App"), a payment provider integration that connects your CRM account to Payfast. We are based in South Africa. For anything about your information, including our information officer, contact support@m.growthhack.co.za.

2. Roles

When you (a business using the App) connect your account, you decide why and how your customers' information is used, and we process it for you to provide the App. We are the responsible party only for information about you as our customer.

3. What we collect

From you, the merchant

• Your account's location identifier and, where provided, company identifier.
• Access tokens that your CRM platform gives the App so it can work on your account.
• Your Payfast merchant ID, merchant key and passphrase, and the access keys we create for the connection between your CRM and the App.
• Your support messages to us.

About your customers, when they pay

• Contact identifier, name, email address and phone number, passed from your CRM so that Payfast can prepare the payment.
• Order or invoice reference, item name and description, amount and currency.
• Payment records: Payfast payment identifier, status, date, refund amounts and reasons, and subscription details (amount, frequency, cycles, next billing date).
• A Payfast token, if the customer chooses to save their card. The token lets you charge the card again through Payfast.

What we do not collect. We never see or store full card numbers, expiry dates or security codes. Customers enter these on Payfast's own pages.

Technical data. Our servers and hosting provider keep standard logs, such as IP address, time and request type, to keep the service secure and working.

4. Why we use it

• To open Payfast checkout, record payments and confirm them.
• To process refunds, saved-card payments and subscriptions you request.
• To tell your CRM platform the result of a payment.
• To secure the App, prevent fraud and fix problems.
• To answer support requests and meet legal obligations.

We do not sell personal information and we do not use it for advertising.

5. Who we share it with

• Payfast, which processes the payment and has its own privacy policy.
• The CRM platform on which you installed the App, to show payment results in your account.
• Our hosting provider, Render, which stores the App's data on our behalf in Frankfurt, Germany.
• Authorities or advisers, only when the law requires it or to protect legal rights.

6. Security

Merchant keys, passphrases, saved-card tokens and access tokens are encrypted in storage. Traffic is sent over HTTPS. Payment notifications are checked for a valid signature, sender, amount and confirmation from Payfast before they are trusted. Each account's records are kept separate. No system is perfectly secure. Where the law requires, we will tell affected merchants and the regulator after a data breach.

7. Where information is stored

Our hosting provider stores data in Germany, which is outside South Africa. We only use providers that protect information to a standard comparable to South African law.

8. How long we keep it

• While the App is installed on your account.
• After uninstall or on your request, we delete your data within 30 days, except records we must keep by law, such as financial records, for the period the law requires.
• Backups are removed on their normal cycle, within 30 days.

9. Your rights

Under the Protection of Personal Information Act (POPIA), and the GDPR where it applies, you and your customers may ask us to confirm what we hold, correct it, delete it, restrict or object to its use, or give a copy. Email support@m.growthhack.co.za. We reply within 30 days. Customers of a merchant should contact that merchant first, and we will assist the merchant. You may complain to the Information Regulator (South Africa) at inforeg.org.za, or to your local authority.

10. Children

The App is for businesses and is not aimed at children. We do not knowingly collect information from children.

11. Changes

We may update this policy. We will change the date above and, for significant changes, tell merchants by email or in the App.

12. Contact

GROWTH HACK, South Africa. support@m.growthhack.co.za.